@nanobpm/urban 0.54.0 → 0.55.0

package/dist/runtime/core/host.d.ts

@@ -216,6 +216,17 @@ export interface UserTaskSummary {
     /** An external form reference (a form linked outside the deployment), if any. */
     readonly externalFormReference?: string;
 }
+/**
+ * The lifecycle-state-agnostic selectors for a user-task search: which process instance,
+ * assignee, and/or candidate group to match. Shared by {@link EngineClient.searchUserTasks}
+ * (which adds an optional `state`) and {@link EngineClient.openUserTasks} (which pins
+ * `state: "CREATED"` for you), so the two accessors cannot drift on how a task is selected.
+ */
+export interface UserTaskFilter {
+    processInstanceKey?: string;
+    assignee?: string;
+    candidateGroup?: string;
+}
 /**
  * A deployed form's form-js schema plus its identifying metadata, as
  * {@link EngineClient.getForm} returns it. `schema` is the parsed form-js document
@@ -267,13 +278,28 @@ export interface EngineClient {
      *  By default this is unfiltered by lifecycle state and may return tasks in any state
      *  (e.g. completed/canceled); pass `state: "CREATED"` to constrain the search to open
      *  (answerable) tasks. Each result carries the task's resolved form linkage
-     *  (`formKey`/`externalFormReference`) when present. */
-    searchUserTasks(filter?: {
-        processInstanceKey?: string;
-        assignee?: string;
-        candidateGroup?: string;
+     *  (`formKey`/`externalFormReference`) when present.
+     *
+     *  **Footgun:** because this defaults to *any* lifecycle state and lags a completion,
+     *  a just-answered task is still returned for a moment — so treating mere *existence*
+     *  of a result as "open / actionable" projects a completed task as if a human could
+     *  still act on it (a torn read-model row). {@link UserTaskSummary} deliberately omits
+     *  `state`, so a caller cannot re-filter results defensively. If you are deciding
+     *  whether a human can act — any reconcile / affordance path — use
+     *  {@link EngineClient.openUserTasks} instead; reserve `searchUserTasks` for the rare
+     *  legitimate "any lifecycle state" audit/read case. */
+    searchUserTasks(filter?: UserTaskFilter & {
         state?: UserTaskState;
     }): Promise<UserTaskSummary[]>;
+    /** The user tasks that are actually *open* (answerable) — semantically the accessor to
+     *  reach for whenever you are deciding whether a human can act (reconcile / affordance
+     *  paths). A thin, intent-named wrapper that pins the lifecycle-state invariant the SDK
+     *  documents: exactly `searchUserTasks({ ...filter, state: "CREATED" })`, since `CREATED`
+     *  is the only open state ({@link UserTaskState}). Unlike a bare `searchUserTasks`, it
+     *  cannot surface a completed/canceled task as if it were still actionable — the footgun
+     *  described on `searchUserTasks`. Same selectors as `searchUserTasks` minus `state`
+     *  (pinned to `CREATED`). */
+    openUserTasks(filter?: UserTaskFilter): Promise<UserTaskSummary[]>;
     /**
      * Fetch a deployed form's form-js schema for the `taskInbox` surface. Resolve by
      * `formKey` (the linkage the engine attaches to a user task) or, as a best-effort

package/dist/runtime/core/modules/pages.js

@@ -1015,7 +1015,9 @@ function resolveCopyText(text) {
 function openModal(m) {
   // Only one modal at a time — drop a second (e.g. double-click) open so we
   // never stack overlays or register duplicate document-level keydown handlers.
-  if (modalOpen) return;
+  // Return null (not a close fn) so a guarded caller (confirmModal) can tell the
+  // open was dropped and resolve rather than hang.
+  if (modalOpen) return null;
   modalOpen = true;
   const overlay = el("div", { class: "pc-modal-overlay" });
   // role="dialog" + aria-modal need an accessible name: label by the visible
@@ -1034,6 +1036,13 @@ function openModal(m) {
   // Remember what had focus so we can restore it on close — a keyboard/screen
   // reader user returns to where they were instead of being dumped at <body>.
   const prevFocus = document.activeElement;
+  // A dismissal (✕/Close button, backdrop, Escape, page switch) resolves with
+  // m.dismissValue; an action button overrides it before closing. onResult fires
+  // exactly once, from close(), so every exit path (button OR dismiss) reports a
+  // result — this is what lets confirmModal() gate on a real user choice inside a
+  // sandboxed iframe where native confirm() would silently return false (#276).
+  const onResult = typeof m.onResult === "function" ? m.onResult : null;
+  let resultValue = m.dismissValue;
   let closed = false;
   function close() {
     if (closed) return;
@@ -1046,6 +1055,9 @@ function openModal(m) {
     // accrete dead close() closures until the next page navigation runs teardown.
     const i = disposers.indexOf(close);
     if (i !== -1) disposers.splice(i, 1);
+    // A consumer-provided result callback must never abort teardown: if it throws,
+    // swallow it so focus restoration below (and Escape/backdrop close) still runs.
+    if (onResult) { try { onResult(resultValue); } catch (_e) {} }
     if (prevFocus && typeof prevFocus.focus === "function") prevFocus.focus();
   }
   // Focusable descendants of the dialog, in DOM order, for the Tab focus trap.
@@ -1078,7 +1090,29 @@ function openModal(m) {
   }
   const closeBtn = el("button", { class: "pc-btn pc-btn-sm pc-btn-ghost", type: "button" }, m.closeLabel || "Close");
   closeBtn.addEventListener("click", close);
-  actions.append(closeBtn);
+  // Custom action buttons (m.actions) turn this into a decision dialog — each
+  // sets the result then closes; the plain Close button is the default when none
+  // are given. This is the in-DOM replacement for native confirm()/alert(): one
+  // overlay + focus-trap + teardown machinery, no drift (AGENTS.md).
+  let focusBtn = closeBtn;
+  if (Array.isArray(m.actions) && m.actions.length) {
+    let firstActionBtn = null;
+    let defaultBtn = null;
+    for (const a of m.actions) {
+      const cls = "pc-btn pc-btn-sm" + (a.variant === "ghost" ? " pc-btn-ghost" : "");
+      const ab = el("button", { class: cls, type: "button" }, a.label);
+      ab.addEventListener("click", () => { resultValue = a.value; close(); });
+      actions.append(ab);
+      if (!firstActionBtn) firstActionBtn = ab;
+      if (a.default) defaultBtn = ab;
+    }
+    // Default focus lands on the FIRST action (typically Cancel), never the last:
+    // for confirmModal that keeps a stray Enter from accidentally triggering the
+    // destructive Confirm. An action can opt into autofocus with default:true.
+    focusBtn = defaultBtn || firstActionBtn;
+  } else {
+    actions.append(closeBtn);
+  }
   dialog.append(actions);
   overlay.append(dialog);
   // A click on the backdrop (never the dialog itself) dismisses.
@@ -1088,7 +1122,36 @@ function openModal(m) {
   // A page switch runs teardown() before the next render — dispose the modal
   // there too so navigating away never leaves a stale overlay + keydown listener.
   disposers.push(close);
-  closeBtn.focus();
+  focusBtn.focus();
+  return close;
+}
+
+// In-DOM confirm — an accessible replacement for native confirm() that works in
+// a sandboxed iframe (without allow-modals native confirm() silently returns
+// false, dead-ending every confirm-guarded action; #276). Renders the message
+// with Cancel/Confirm and resolves the user's choice; a dismissal (Escape /
+// backdrop / ✕) resolves false. If a modal is already open the guarded open is
+// dropped — resolve false so the caller doesn't hang.
+function confirmModal(message) {
+  return new Promise((resolve) => {
+    const opened = openModal({
+      title: "Confirm",
+      description: String(message),
+      dismissValue: false,
+      actions: [
+        { label: "Cancel", value: false, variant: "ghost" },
+        { label: "Confirm", value: true },
+      ],
+      onResult: (v) => resolve(!!v),
+    });
+    if (!opened) resolve(false);
+  });
+}
+
+// In-DOM error surface — replaces native alert(), which a sandboxed iframe also
+// suppresses, so action failures reported through it were invisible (#276).
+function alertModal(message) {
+  openModal({ title: "Error", description: String(message) });
 }
 
 // A standalone button node. Clicking it opens props.modal — used e.g. to surface
@@ -2032,14 +2095,18 @@ function renderDataGrid(node) {
     const b = el("button", { class: "pc-btn pc-btn-sm" }, ra.label);
     b.addEventListener("click", async (ev) => {
       ev.stopPropagation();
-      if (ra.confirm && !confirm(ra.confirm)) return;
+      // In-DOM confirm/error (openModal) instead of native confirm()/alert():
+      // a sandboxed iframe without allow-modals makes native confirm() return
+      // false and alert() a no-op, so every confirm-guarded action silently
+      // dead-ended and its errors vanished (#276).
+      if (ra.confirm && !(await confirmModal(ra.confirm))) return;
       b.disabled = true;
       try {
         await fireAction(ra.action, row);
         document.dispatchEvent(new CustomEvent("pc:refresh"));
       } catch (e) {
         b.disabled = false;
-        alert(String(e.message || e));
+        alertModal(String(e.message || e));
       }
     });
     return b;

package/dist/runtime/engine/nanosdk.d.ts

@@ -1,4 +1,4 @@
-import type { EngineClient, FormSchema, JobHandler, ProcessInstanceSnapshot, ProcessInstanceState, UserTaskState, UserTaskSummary, WorkerSubscription } from "../core/host.ts";
+import type { EngineClient, FormSchema, JobHandler, ProcessInstanceSnapshot, ProcessInstanceState, UserTaskState, UserTaskSummary, UserTaskFilter, WorkerSubscription } from "../core/host.ts";
 import type { EngineSdkClient } from "./sdk.ts";
 /** Coerce an engine response's process-instance key to a non-empty string, or
  * throw — a missing key means a malformed/partial response, not a real instance. */
@@ -136,12 +136,13 @@ export declare class SdkEngineClient implements EngineClient {
         correlationKey?: string;
         variables?: Record<string, unknown>;
     }): Promise<void>;
-    searchUserTasks(filter?: {
-        processInstanceKey?: string;
-        assignee?: string;
-        candidateGroup?: string;
+    searchUserTasks(filter?: UserTaskFilter & {
         state?: UserTaskState;
     }): Promise<UserTaskSummary[]>;
+    /** The open (answerable) user tasks — `searchUserTasks` pinned to `state: "CREATED"`.
+     *  The single safe accessor for reconcile/affordance paths (see `EngineClient.openUserTasks`);
+     *  derives from `searchUserTasks` so the two cannot drift. */
+    openUserTasks(filter?: UserTaskFilter): Promise<UserTaskSummary[]>;
     getForm(input: {
         formKey?: string;
         formId?: string;

package/dist/runtime/engine/nanosdk.js

@@ -127,6 +127,12 @@ export class SdkEngineClient {
                 }];
         });
     }
+    /** The open (answerable) user tasks — `searchUserTasks` pinned to `state: "CREATED"`.
+     *  The single safe accessor for reconcile/affordance paths (see `EngineClient.openUserTasks`);
+     *  derives from `searchUserTasks` so the two cannot drift. */
+    openUserTasks(filter) {
+        return this.searchUserTasks({ ...filter, state: "CREATED" });
+    }
     async getForm(input) {
         // The engine addresses deployed forms by key (`GET /forms/{formKey}`). A user task's
         // `formKey` is the engine's resolution of its `formId` linkage to the latest deployed

package/dist/runtime/index.d.ts

@@ -8,7 +8,7 @@ export { bindModeToHost, expandEnv, expandEnvString, isBindMode, loadManifest, p
 export type { ActionDecl, AppManifest, BindMode, ChatSurface, DataSource, DomainField, DomainType, LlmBinding, NetworkConfig, PagesSurface, Surfaces, TaskInboxSurface, Trigger, Worker, } from "./core/manifest.ts";
 export { collectManifestIssues, ManifestValidationError, validateManifest, } from "./core/validate.ts";
 export type { ValidationIssue } from "./core/validate.ts";
-export type { EngineClient, EngineJob, FormSchema, HostContext, HttpHandler, HttpRequest, HttpResponse, HttpServer, JobHandler, ProcessInstanceSnapshot, ProcessInstanceState, SqliteDb, UserTaskState, UserTaskSummary, WatchHandle, WorkerSubscription, } from "./core/host.ts";
+export type { EngineClient, EngineJob, FormSchema, HostContext, HttpHandler, HttpRequest, HttpResponse, HttpServer, JobHandler, ProcessInstanceSnapshot, ProcessInstanceState, SqliteDb, UserTaskState, UserTaskSummary, UserTaskFilter, WatchHandle, WorkerSubscription, } from "./core/host.ts";
 export { buildFormSchema, parseFormSchema, pickFormLinkage, presentFormIdentifier, resolveFormIdentifier, } from "./core/form-contract.ts";
 export type { AppApi, Mounted, RuntimeContext } from "./core/context.ts";
 export { createLogger } from "./core/logger.ts";

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@nanobpm/urban",
-	"version": "0.54.0",
+	"version": "0.55.0",
 	"description": "Urban: build and run code-first apps on Nano — runtime, derivation toolkit, and CLI in one. Author durable processes with @nanobpm/workflow (defineFlow), a typed datasource, forms, triggers and surfaces from a nano.app.json manifest, on Node or Deno.",
 	"license": "Apache-2.0",
 	"type": "module",

package/src/runtime/core/host.ts

@@ -249,6 +249,18 @@ export interface UserTaskSummary {
   readonly externalFormReference?: string;
 }
 
+/**
+ * The lifecycle-state-agnostic selectors for a user-task search: which process instance,
+ * assignee, and/or candidate group to match. Shared by {@link EngineClient.searchUserTasks}
+ * (which adds an optional `state`) and {@link EngineClient.openUserTasks} (which pins
+ * `state: "CREATED"` for you), so the two accessors cannot drift on how a task is selected.
+ */
+export interface UserTaskFilter {
+  processInstanceKey?: string;
+  assignee?: string;
+  candidateGroup?: string;
+}
+
 /**
  * A deployed form's form-js schema plus its identifying metadata, as
  * {@link EngineClient.getForm} returns it. `schema` is the parsed form-js document
@@ -292,13 +304,28 @@ export interface EngineClient {
    *  By default this is unfiltered by lifecycle state and may return tasks in any state
    *  (e.g. completed/canceled); pass `state: "CREATED"` to constrain the search to open
    *  (answerable) tasks. Each result carries the task's resolved form linkage
-   *  (`formKey`/`externalFormReference`) when present. */
-  searchUserTasks(filter?: {
-    processInstanceKey?: string;
-    assignee?: string;
-    candidateGroup?: string;
+   *  (`formKey`/`externalFormReference`) when present.
+   *
+   *  **Footgun:** because this defaults to *any* lifecycle state and lags a completion,
+   *  a just-answered task is still returned for a moment — so treating mere *existence*
+   *  of a result as "open / actionable" projects a completed task as if a human could
+   *  still act on it (a torn read-model row). {@link UserTaskSummary} deliberately omits
+   *  `state`, so a caller cannot re-filter results defensively. If you are deciding
+   *  whether a human can act — any reconcile / affordance path — use
+   *  {@link EngineClient.openUserTasks} instead; reserve `searchUserTasks` for the rare
+   *  legitimate "any lifecycle state" audit/read case. */
+  searchUserTasks(filter?: UserTaskFilter & {
     state?: UserTaskState;
   }): Promise<UserTaskSummary[]>;
+  /** The user tasks that are actually *open* (answerable) — semantically the accessor to
+   *  reach for whenever you are deciding whether a human can act (reconcile / affordance
+   *  paths). A thin, intent-named wrapper that pins the lifecycle-state invariant the SDK
+   *  documents: exactly `searchUserTasks({ ...filter, state: "CREATED" })`, since `CREATED`
+   *  is the only open state ({@link UserTaskState}). Unlike a bare `searchUserTasks`, it
+   *  cannot surface a completed/canceled task as if it were still actionable — the footgun
+   *  described on `searchUserTasks`. Same selectors as `searchUserTasks` minus `state`
+   *  (pinned to `CREATED`). */
+  openUserTasks(filter?: UserTaskFilter): Promise<UserTaskSummary[]>;
   /**
    * Fetch a deployed form's form-js schema for the `taskInbox` surface. Resolve by
    * `formKey` (the linkage the engine attaches to a user task) or, as a best-effort

package/src/runtime/core/modules/actions.test.ts

@@ -29,6 +29,7 @@ const engine: EngineClient = {
   cancelInstance: async () => {},
   publishMessage: async () => {},
   searchUserTasks: async () => [],
+  openUserTasks: async () => [],
   getForm: async () => null,
   completeUserTask: async () => {},
   searchProcessInstances: async () => [],

package/src/runtime/core/modules/agent.test.ts

@@ -13,6 +13,7 @@ const fakeEngine: EngineClient = {
   cancelInstance: async () => {},
   publishMessage: async () => {},
   searchUserTasks: async () => [],
+  openUserTasks: async () => [],
   getForm: async () => null,
   completeUserTask: async () => {},
   searchProcessInstances: async () => [],

package/src/runtime/core/modules/api.test.ts

@@ -28,6 +28,7 @@ const engine: EngineClient = {
   cancelInstance: async () => {},
   publishMessage: async () => {},
   searchUserTasks: async () => [],
+  openUserTasks: async () => [],
   getForm: async () => null,
   searchProcessInstances: async () => [],
   completeUserTask: async () => {},

package/src/runtime/core/modules/cancel.test.ts

@@ -73,6 +73,7 @@ function cancelEngine(opts: {
     createInstance: notUsed("createInstance"),
     publishMessage: notUsed("publishMessage"),
     searchUserTasks: notUsed("searchUserTasks"),
+    openUserTasks: notUsed("openUserTasks"),
     getForm: notUsed("getForm"),
     completeUserTask: notUsed("completeUserTask"),
     registerWorker: notUsed("registerWorker"),

package/src/runtime/core/modules/connectors.test.ts

@@ -17,6 +17,7 @@ class MiniEngine implements EngineClient {
   async cancelInstance(): Promise<void> {}
   async publishMessage(): Promise<void> {}
   async searchUserTasks(): Promise<[]> { return []; }
+  async openUserTasks(): Promise<[]> { return []; }
   async getForm(): Promise<null> { return null; }
   async completeUserTask(): Promise<void> {}
   async searchProcessInstances(): Promise<[]> { return []; }

package/src/runtime/core/modules/datasource.migrations.test.ts

@@ -16,6 +16,7 @@ const noEngine: EngineClient = {
   cancelInstance: async () => {},
   publishMessage: async () => {},
   searchUserTasks: async () => [],
+  openUserTasks: async () => [],
   getForm: async () => null,
   completeUserTask: async () => {},
   searchProcessInstances: async () => [],

package/src/runtime/core/modules/instance-tracking.test.ts

@@ -96,6 +96,7 @@ function fakeEngine(states: Record<string, ProcessInstanceSnapshot["state"]>): {
     cancelInstance: notUsed("cancelInstance"),
     publishMessage: notUsed("publishMessage"),
     searchUserTasks: notUsed("searchUserTasks"),
+    openUserTasks: notUsed("openUserTasks"),
     getForm: notUsed("getForm"),
     completeUserTask: notUsed("completeUserTask"),
     registerWorker: notUsed("registerWorker"),

package/src/runtime/core/modules/pages.test.ts

@@ -40,6 +40,7 @@ function fakeEngine(): { engine: EngineClient; calls: FakeEngineCalls } {
       calls.messages.push(input);
     },
     async searchUserTasks() { return []; },
+    async openUserTasks() { return []; },
     async getForm() { return null; },
     async completeUserTask() {},
     async searchProcessInstances() { return []; },
@@ -891,6 +892,46 @@ test("the renderer ships a button node that opens a copy-pasteable modal", async
 });
 
 
+test("row-action confirm/error route through the in-DOM modal, never native confirm()/alert() (#276)", async () => {
+  // A sandboxed iframe without `allow-modals` makes window.confirm() return false
+  // WITHOUT prompting and turns alert()/prompt() into no-ops — so every
+  // confirm-guarded row action silently dead-ended (the !confirm(...) guard was
+  // always true → fireAction never ran) and its errors vanished. The fix routes
+  // both through urban's in-DOM openModal overlay, which works with no host
+  // sandbox change.
+  const res = await dispatch("GET", "/app/runtime.js");
+  const js = res.body ?? "";
+  // The confirm gate awaits an in-DOM dialog and only proceeds on a real choice.
+  assert.match(js, /if \(ra\.confirm && !\(await confirmModal\(ra\.confirm\)\)\) return/);
+  // Errors surface through the in-DOM alert instead of the suppressed native one.
+  assert.match(js, /alertModal\(String\(e\.message \|\| e\)\)/);
+  // The primitives exist and are built on the shared openModal overlay (no drift).
+  assert.match(js, /function confirmModal\(message\)/);
+  assert.match(js, /return new Promise\(\(resolve\) => \{/);
+  assert.match(js, /function alertModal\(message\)/);
+  // A dropped guarded open (a modal already showing) resolves false, never hangs.
+  assert.match(js, /if \(!opened\) resolve\(false\)/);
+  // openModal grew action buttons + a single-fire result callback so it can back a
+  // decision dialog; a dismissal (Escape/backdrop/✕/page switch) resolves the
+  // caller's default (dismissValue).
+  assert.match(js, /Array\.isArray\(m\.actions\)/);
+  assert.match(js, /resultValue = a\.value; close\(\);/);
+  // Match the semantic call site only — teardown wraps onResult in a try/catch so
+  // a throwing callback can't abort focus restoration, so don't pin the control flow.
+  assert.match(js, /onResult\(resultValue\)/);
+  // Defect-class guard: NO native confirm()/alert()/prompt() CALL (invoked with a
+  // string/identifier/template argument) survives anywhere in the served bundle —
+  // they are all false/no-ops under a sandboxed iframe. This also catches qualified
+  // calls (window.confirm(...) / globalThis.alert(...)): the lookbehind only excludes
+  // a preceding word char (so confirmModal(...) / alertModal(...) don't match), not a
+  // preceding ".", so a member call still trips the guard. The argument-start class
+  // covers string/template literals and identifier heads including $ and _
+  // (e.g. confirm(_msg), alert($msg), prompt(`...`)). Empty-paren mentions in
+  // comments (e.g. "native confirm()") are documentation, not calls, so are not matched.
+  assert.doesNotMatch(js, /(?<!\w)(?:confirm|alert|prompt)\(\s*["'`$_a-zA-Z]/);
+});
+
+
 test("the renderer ships a data-bound prose/markdown list node (#274)", async () => {
   const res = await dispatch("GET", "/app/runtime.js");
   const js = res.body ?? "";

package/src/runtime/core/modules/pages.ts

@@ -1068,7 +1068,9 @@ function resolveCopyText(text) {
 function openModal(m) {
   // Only one modal at a time — drop a second (e.g. double-click) open so we
   // never stack overlays or register duplicate document-level keydown handlers.
-  if (modalOpen) return;
+  // Return null (not a close fn) so a guarded caller (confirmModal) can tell the
+  // open was dropped and resolve rather than hang.
+  if (modalOpen) return null;
   modalOpen = true;
   const overlay = el("div", { class: "pc-modal-overlay" });
   // role="dialog" + aria-modal need an accessible name: label by the visible
@@ -1087,6 +1089,13 @@ function openModal(m) {
   // Remember what had focus so we can restore it on close — a keyboard/screen
   // reader user returns to where they were instead of being dumped at <body>.
   const prevFocus = document.activeElement;
+  // A dismissal (✕/Close button, backdrop, Escape, page switch) resolves with
+  // m.dismissValue; an action button overrides it before closing. onResult fires
+  // exactly once, from close(), so every exit path (button OR dismiss) reports a
+  // result — this is what lets confirmModal() gate on a real user choice inside a
+  // sandboxed iframe where native confirm() would silently return false (#276).
+  const onResult = typeof m.onResult === "function" ? m.onResult : null;
+  let resultValue = m.dismissValue;
   let closed = false;
   function close() {
     if (closed) return;
@@ -1099,6 +1108,9 @@ function openModal(m) {
     // accrete dead close() closures until the next page navigation runs teardown.
     const i = disposers.indexOf(close);
     if (i !== -1) disposers.splice(i, 1);
+    // A consumer-provided result callback must never abort teardown: if it throws,
+    // swallow it so focus restoration below (and Escape/backdrop close) still runs.
+    if (onResult) { try { onResult(resultValue); } catch (_e) {} }
     if (prevFocus && typeof prevFocus.focus === "function") prevFocus.focus();
   }
   // Focusable descendants of the dialog, in DOM order, for the Tab focus trap.
@@ -1131,7 +1143,29 @@ function openModal(m) {
   }
   const closeBtn = el("button", { class: "pc-btn pc-btn-sm pc-btn-ghost", type: "button" }, m.closeLabel || "Close");
   closeBtn.addEventListener("click", close);
-  actions.append(closeBtn);
+  // Custom action buttons (m.actions) turn this into a decision dialog — each
+  // sets the result then closes; the plain Close button is the default when none
+  // are given. This is the in-DOM replacement for native confirm()/alert(): one
+  // overlay + focus-trap + teardown machinery, no drift (AGENTS.md).
+  let focusBtn = closeBtn;
+  if (Array.isArray(m.actions) && m.actions.length) {
+    let firstActionBtn = null;
+    let defaultBtn = null;
+    for (const a of m.actions) {
+      const cls = "pc-btn pc-btn-sm" + (a.variant === "ghost" ? " pc-btn-ghost" : "");
+      const ab = el("button", { class: cls, type: "button" }, a.label);
+      ab.addEventListener("click", () => { resultValue = a.value; close(); });
+      actions.append(ab);
+      if (!firstActionBtn) firstActionBtn = ab;
+      if (a.default) defaultBtn = ab;
+    }
+    // Default focus lands on the FIRST action (typically Cancel), never the last:
+    // for confirmModal that keeps a stray Enter from accidentally triggering the
+    // destructive Confirm. An action can opt into autofocus with default:true.
+    focusBtn = defaultBtn || firstActionBtn;
+  } else {
+    actions.append(closeBtn);
+  }
   dialog.append(actions);
   overlay.append(dialog);
   // A click on the backdrop (never the dialog itself) dismisses.
@@ -1141,7 +1175,36 @@ function openModal(m) {
   // A page switch runs teardown() before the next render — dispose the modal
   // there too so navigating away never leaves a stale overlay + keydown listener.
   disposers.push(close);
-  closeBtn.focus();
+  focusBtn.focus();
+  return close;
+}
+
+// In-DOM confirm — an accessible replacement for native confirm() that works in
+// a sandboxed iframe (without allow-modals native confirm() silently returns
+// false, dead-ending every confirm-guarded action; #276). Renders the message
+// with Cancel/Confirm and resolves the user's choice; a dismissal (Escape /
+// backdrop / ✕) resolves false. If a modal is already open the guarded open is
+// dropped — resolve false so the caller doesn't hang.
+function confirmModal(message) {
+  return new Promise((resolve) => {
+    const opened = openModal({
+      title: "Confirm",
+      description: String(message),
+      dismissValue: false,
+      actions: [
+        { label: "Cancel", value: false, variant: "ghost" },
+        { label: "Confirm", value: true },
+      ],
+      onResult: (v) => resolve(!!v),
+    });
+    if (!opened) resolve(false);
+  });
+}
+
+// In-DOM error surface — replaces native alert(), which a sandboxed iframe also
+// suppresses, so action failures reported through it were invisible (#276).
+function alertModal(message) {
+  openModal({ title: "Error", description: String(message) });
 }
 
 // A standalone button node. Clicking it opens props.modal — used e.g. to surface
@@ -2085,14 +2148,18 @@ function renderDataGrid(node) {
     const b = el("button", { class: "pc-btn pc-btn-sm" }, ra.label);
     b.addEventListener("click", async (ev) => {
       ev.stopPropagation();
-      if (ra.confirm && !confirm(ra.confirm)) return;
+      // In-DOM confirm/error (openModal) instead of native confirm()/alert():
+      // a sandboxed iframe without allow-modals makes native confirm() return
+      // false and alert() a no-op, so every confirm-guarded action silently
+      // dead-ended and its errors vanished (#276).
+      if (ra.confirm && !(await confirmModal(ra.confirm))) return;
       b.disabled = true;
       try {
         await fireAction(ra.action, row);
         document.dispatchEvent(new CustomEvent("pc:refresh"));
       } catch (e) {
         b.disabled = false;
-        alert(String(e.message || e));
+        alertModal(String(e.message || e));
       }
     });
     return b;

package/src/runtime/core/modules/surfaces.test.ts

@@ -29,6 +29,7 @@ function ctxWith(surfaces: Record<string, unknown>): Parameters<typeof mountSurf
     cancelInstance: async () => {},
     publishMessage: async () => {},
     searchUserTasks: async () => [],
+    openUserTasks: async () => [],
     getForm: async () => null,
     completeUserTask: async () => {},
     searchProcessInstances: async () => [],
@@ -44,6 +45,7 @@ const fakeEngine: EngineClient = {
   cancelInstance: async () => {},
   publishMessage: async () => {},
   searchUserTasks: async () => [],
+  openUserTasks: async () => [],
   getForm: async () => null,
   completeUserTask: async () => {},
   searchProcessInstances: async () => [],

package/src/runtime/core/modules/triggers.test.ts

@@ -30,6 +30,7 @@ class MiniEngine implements EngineClient {
     this.calls.push({ kind: "message", target: input.name, correlationKey: input.correlationKey, variables: input.variables });
   }
   async searchUserTasks(): Promise<[]> { return []; }
+  async openUserTasks(): Promise<[]> { return []; }
   async getForm(): Promise<null> { return null; }
   async completeUserTask(): Promise<void> {}
   async searchProcessInstances(): Promise<[]> { return []; }

package/src/runtime/core/modules/workers.test.ts

@@ -27,6 +27,7 @@ class MiniEngine implements EngineClient {
   async cancelInstance(): Promise<void> {}
   async publishMessage(): Promise<void> {}
   async searchUserTasks(): Promise<[]> { return []; }
+  async openUserTasks(): Promise<[]> { return []; }
   async getForm(): Promise<null> { return null; }
   async completeUserTask(): Promise<void> {}
   async searchProcessInstances(): Promise<[]> { return []; }

package/src/runtime/core/runtime.extensions.test.ts

@@ -22,6 +22,9 @@ class NoopEngine implements EngineClient {
   async searchUserTasks() {
     return [];
   }
+  async openUserTasks() {
+    return [];
+  }
   async getForm() {
     return null;
   }

package/src/runtime/core/runtime.test.ts

@@ -41,6 +41,9 @@ class FakeEngine implements EngineClient {
   async searchUserTasks() {
     return this.userTasks;
   }
+  async openUserTasks() {
+    return this.userTasks;
+  }
   async getForm() {
     return null;
   }

package/src/runtime/engine/nanosdk.test.ts

@@ -231,6 +231,24 @@ test("searchUserTasks forwards a caller-provided lifecycle state filter", async
   assert.equal(input?.filter?.processInstanceKey, "pi");
 });
 
+test("openUserTasks pins state=CREATED onto the underlying search", async () => {
+  let input: { filter?: Record<string, unknown> } | undefined;
+  const client = fakeSdkClient({
+    searchUserTasks: async (i) => {
+      input = i;
+      return { items: [{ userTaskKey: 9, elementId: "approve" }] };
+    },
+  });
+  const engine = new SdkEngineClient(client);
+  const tasks = await engine.openUserTasks({ processInstanceKey: "pi" });
+  // openUserTasks is the safe accessor: it derives from searchUserTasks with state pinned to
+  // CREATED, so a completed/canceled task can never surface through it. The caller's other
+  // selectors pass through unchanged.
+  assert.equal(input?.filter?.state, "CREATED", "openUserTasks pins state=CREATED");
+  assert.equal(input?.filter?.processInstanceKey, "pi");
+  assert.deepEqual(tasks, [{ userTaskKey: "9", elementId: "approve", variables: undefined }]);
+});
+
 test("searchUserTasks surfaces the resolved form linkage", async () => {
   const client = fakeSdkClient({
     searchUserTasks: async () => ({

package/src/runtime/engine/nanosdk.ts

@@ -20,6 +20,7 @@ import type {
   ProcessInstanceState,
   UserTaskState,
   UserTaskSummary,
+  UserTaskFilter,
   WorkerSubscription,
 } from "../core/host.ts";
 import { isBpmnError } from "../core/host.ts";
@@ -230,10 +231,7 @@ export class SdkEngineClient implements EngineClient {
     });
   }
 
-  async searchUserTasks(filter?: {
-    processInstanceKey?: string;
-    assignee?: string;
-    candidateGroup?: string;
+  async searchUserTasks(filter?: UserTaskFilter & {
     state?: UserTaskState;
   }): Promise<UserTaskSummary[]> {
     // User tasks are an eventually consistent read; ask for zero-wait consistency so
@@ -261,6 +259,13 @@ export class SdkEngineClient implements EngineClient {
     });
   }
 
+  /** The open (answerable) user tasks — `searchUserTasks` pinned to `state: "CREATED"`.
+   *  The single safe accessor for reconcile/affordance paths (see `EngineClient.openUserTasks`);
+   *  derives from `searchUserTasks` so the two cannot drift. */
+  openUserTasks(filter?: UserTaskFilter): Promise<UserTaskSummary[]> {
+    return this.searchUserTasks({ ...filter, state: "CREATED" });
+  }
+
   async getForm(input: { formKey?: string; formId?: string }): Promise<FormSchema | null> {
     // The engine addresses deployed forms by key (`GET /forms/{formKey}`). A user task's
     // `formKey` is the engine's resolution of its `formId` linkage to the latest deployed

package/src/runtime/index.ts

@@ -95,6 +95,7 @@ export type {
   SqliteDb,
   UserTaskState,
   UserTaskSummary,
+  UserTaskFilter,
   WatchHandle,
   WorkerSubscription,
 } from "./core/host.ts";